Skip to content

Commit c014bf6

Browse files
author
Matt Luttrell
committedDec 6, 2023
converting tabs to spaces
1 parent 907225d commit c014bf6

38 files changed

+1599
-1599
lines changed
 

‎identity-policies/check-access-to-sensitive-resource/cloudformation-stack.md

Lines changed: 49 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -59,37 +59,37 @@ This reference policy checks if a candidate policy grants access to any of the l
5959
###### Candidate policy 1: PASS - does not grant access to sensitive stack
6060
```json
6161
{
62-
"Version": "2012-10-17",
63-
"Statement": [
64-
{
65-
"Effect": "Allow",
66-
"Action": [
67-
"cloudformation:UpdateStack",
68-
"cloudformation:DeleteStack",
69-
"cloudformation:RollbackStack"
70-
],
71-
"Resource": "arn:aws:cloudformation:*:*:stack/NotMySensitiveStack/*"
72-
}
73-
]
62+
"Version": "2012-10-17",
63+
"Statement": [
64+
{
65+
"Effect": "Allow",
66+
"Action": [
67+
"cloudformation:UpdateStack",
68+
"cloudformation:DeleteStack",
69+
"cloudformation:RollbackStack"
70+
],
71+
"Resource": "arn:aws:cloudformation:*:*:stack/NotMySensitiveStack/*"
72+
}
73+
]
7474
}
7575
```
7676

7777
###### Candidate policy 2: PASS - explicitly denies access to sensitive stack
7878
```json
7979
{
80-
"Version": "2012-10-17",
81-
"Statement": [
82-
{
83-
"Effect": "Allow",
84-
"Action": "cloudformation:*",
85-
"Resource": "*"
86-
},
87-
{
88-
"Effect": "Deny",
89-
"Action": "*",
90-
"Resource": "arn:aws:cloudformation:*:*:stack/MySensitiveStack/*"
91-
}
92-
]
80+
"Version": "2012-10-17",
81+
"Statement": [
82+
{
83+
"Effect": "Allow",
84+
"Action": "cloudformation:*",
85+
"Resource": "*"
86+
},
87+
{
88+
"Effect": "Deny",
89+
"Action": "*",
90+
"Resource": "arn:aws:cloudformation:*:*:stack/MySensitiveStack/*"
91+
}
92+
]
9393
}
9494
```
9595

@@ -98,41 +98,41 @@ This reference policy checks if a candidate policy grants access to any of the l
9898
###### Candidate policy 3: FAIL - grants access to use the DeleteStack action on stack/MySensitiveStack/*
9999
```json
100100
{
101-
"Version": "2012-10-17",
102-
"Statement": [
103-
{
104-
"Effect": "Allow",
105-
"Action": "cloudformation:DeleteStack",
106-
"Resource": "arn:aws:cloudformation:*:*:stack/MySensitiveStack/*"
107-
}
108-
]
101+
"Version": "2012-10-17",
102+
"Statement": [
103+
{
104+
"Effect": "Allow",
105+
"Action": "cloudformation:DeleteStack",
106+
"Resource": "arn:aws:cloudformation:*:*:stack/MySensitiveStack/*"
107+
}
108+
]
109109
}
110110
```
111111

112112
###### Candidate policy 3: FAIL - grants access to use the DeleteStack action and stack/MySensitiveStack/* is included in the resource wildcard.
113113
```json
114114
{
115-
"Version": "2012-10-17",
116-
"Statement": [
117-
{
118-
"Effect": "Allow",
119-
"Action": "cloudformation:DeleteStack",
120-
"Resource": "arn:aws:cloudformation:*:*:stack/*Sensitive*/*"
121-
}
122-
]
115+
"Version": "2012-10-17",
116+
"Statement": [
117+
{
118+
"Effect": "Allow",
119+
"Action": "cloudformation:DeleteStack",
120+
"Resource": "arn:aws:cloudformation:*:*:stack/*Sensitive*/*"
121+
}
122+
]
123123
}
124124
```
125125

126126
###### Candidate policy 4: FAIL - grants access to use all CloudFormation actions and stack/MySensitiveStack/* is included in the resource wildcard.
127127
```json
128128
{
129-
"Version": "2012-10-17",
130-
"Statement": [
131-
{
132-
"Effect": "Allow",
133-
"Action": "cloudformation:*",
134-
"Resource": "*"
135-
}
136-
]
129+
"Version": "2012-10-17",
130+
"Statement": [
131+
{
132+
"Effect": "Allow",
133+
"Action": "cloudformation:*",
134+
"Resource": "*"
135+
}
136+
]
137137
}
138138
```

‎identity-policies/check-access-to-sensitive-resource/ec2-image.md

Lines changed: 41 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -57,37 +57,37 @@ This reference policy checks if a candidate policy grants access to any of the l
5757
###### Candidate policy 1: PASS - does not grant access to sensitive image
5858
```json
5959
{
60-
"Version": "2012-10-17",
61-
"Statement": [
62-
{
63-
"Effect": "Allow",
64-
"Action": [
65-
"ec2:RunInstances",
66-
"ec2:CopyImage",
67-
"ec2:ExportImage"
68-
],
69-
"Resource": "arn:aws:ec2:*:*:image/ami-notsensitive"
70-
}
71-
]
60+
"Version": "2012-10-17",
61+
"Statement": [
62+
{
63+
"Effect": "Allow",
64+
"Action": [
65+
"ec2:RunInstances",
66+
"ec2:CopyImage",
67+
"ec2:ExportImage"
68+
],
69+
"Resource": "arn:aws:ec2:*:*:image/ami-notsensitive"
70+
}
71+
]
7272
}
7373
```
7474

7575
###### Candidate policy 2: PASS - explicitly denies access to sensitive image
7676
```json
7777
{
78-
"Version": "2012-10-17",
79-
"Statement": [
80-
{
81-
"Effect": "Allow",
82-
"Action": "ec2:*",
83-
"Resource": "*"
84-
},
85-
{
86-
"Effect": "Deny",
87-
"Action": "*",
88-
"Resource": "arn:aws:ec2:*:*:image/ami-sensitive"
89-
}
90-
]
78+
"Version": "2012-10-17",
79+
"Statement": [
80+
{
81+
"Effect": "Allow",
82+
"Action": "ec2:*",
83+
"Resource": "*"
84+
},
85+
{
86+
"Effect": "Deny",
87+
"Action": "*",
88+
"Resource": "arn:aws:ec2:*:*:image/ami-sensitive"
89+
}
90+
]
9191
}
9292
```
9393

@@ -96,27 +96,27 @@ This reference policy checks if a candidate policy grants access to any of the l
9696
###### Candidate policy 3: FAIL - grants access to use RunInstances action on sensitive image
9797
```json
9898
{
99-
"Version": "2012-10-17",
100-
"Statement": [
101-
{
102-
"Effect": "Allow",
103-
"Action": "ec2:RunInstances",
104-
"Resource": "arn:aws:ec2:*:*:image/ami-sensitive"
105-
}
106-
]
99+
"Version": "2012-10-17",
100+
"Statement": [
101+
{
102+
"Effect": "Allow",
103+
"Action": "ec2:RunInstances",
104+
"Resource": "arn:aws:ec2:*:*:image/ami-sensitive"
105+
}
106+
]
107107
}
108108
```
109109

110110
###### Candidate policy 4: FAIL - grants access to use all EC2 actions and the sensitive image is included in the resource wildcard.
111111
```json
112112
{
113-
"Version": "2012-10-17",
114-
"Statement": [
115-
{
116-
"Effect": "Allow",
117-
"Action": "ec2:*",
118-
"Resource": "*"
119-
}
120-
]
113+
"Version": "2012-10-17",
114+
"Statement": [
115+
{
116+
"Effect": "Allow",
117+
"Action": "ec2:*",
118+
"Resource": "*"
119+
}
120+
]
121121
}
122122
```

‎identity-policies/check-access-to-sensitive-resource/ec2-instance.md

Lines changed: 41 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -75,37 +75,37 @@ This reference policy checks if a candidate policy grants access to any of the l
7575
###### Candidate policy 1: PASS - does not grant access to sensitive instance
7676
```json
7777
{
78-
"Version": "2012-10-17",
79-
"Statement": [
80-
{
81-
"Effect": "Allow",
82-
"Action": [
83-
"ec2:StopInstances",
84-
"ec2:TerminateInstances",
85-
"ec2:CreateImage"
86-
],
87-
"Resource": "arn:aws:ec2:*:*:i-not-sensitive"
88-
}
89-
]
78+
"Version": "2012-10-17",
79+
"Statement": [
80+
{
81+
"Effect": "Allow",
82+
"Action": [
83+
"ec2:StopInstances",
84+
"ec2:TerminateInstances",
85+
"ec2:CreateImage"
86+
],
87+
"Resource": "arn:aws:ec2:*:*:i-not-sensitive"
88+
}
89+
]
9090
}
9191
```
9292

9393
###### Candidate policy 2: PASS - explicitly denies access to sensitive instance
9494
```json
9595
{
96-
"Version": "2012-10-17",
97-
"Statement": [
98-
{
99-
"Effect": "Allow",
100-
"Action": "ec2:*",
101-
"Resource": "*"
102-
},
103-
{
104-
"Effect": "Deny",
105-
"Action": "*",
106-
"Resource": "arn:aws:ec2:*:*:instance/i-sensitive"
107-
}
108-
]
96+
"Version": "2012-10-17",
97+
"Statement": [
98+
{
99+
"Effect": "Allow",
100+
"Action": "ec2:*",
101+
"Resource": "*"
102+
},
103+
{
104+
"Effect": "Deny",
105+
"Action": "*",
106+
"Resource": "arn:aws:ec2:*:*:instance/i-sensitive"
107+
}
108+
]
109109
}
110110
```
111111

@@ -114,27 +114,27 @@ This reference policy checks if a candidate policy grants access to any of the l
114114
###### Candidate policy 3: FAIL - grants access to use the TerminateInstances action on the sensitive instance
115115
```json
116116
{
117-
"Version": "2012-10-17",
118-
"Statement": [
119-
{
120-
"Effect": "Allow",
121-
"Action": "ec2:TerminateInstances",
122-
"Resource": "arn:aws:ec2:*:*:instance/i-sensitive"
123-
}
124-
]
117+
"Version": "2012-10-17",
118+
"Statement": [
119+
{
120+
"Effect": "Allow",
121+
"Action": "ec2:TerminateInstances",
122+
"Resource": "arn:aws:ec2:*:*:instance/i-sensitive"
123+
}
124+
]
125125
}
126126
```
127127

128128
###### Candidate policy 4: FAIL - grants access to use all EC2 actions and the sensitive instance is included in the resource wildcard.
129129
```json
130130
{
131-
"Version": "2012-10-17",
132-
"Statement": [
133-
{
134-
"Effect": "Allow",
135-
"Action": "ec2:*",
136-
"Resource": "*"
137-
}
138-
]
131+
"Version": "2012-10-17",
132+
"Statement": [
133+
{
134+
"Effect": "Allow",
135+
"Action": "ec2:*",
136+
"Resource": "*"
137+
}
138+
]
139139
}
140140
```

0 commit comments

Comments
 (0)
Please sign in to comment.